Extracted

• • Target

    2025-01-22_ea6a79472c1a6baf04ad2dd54187b0f8_mafia

  • Size

    10.4MB

  • MD5

    ea6a79472c1a6baf04ad2dd54187b0f8

  • SHA1

    36f78e2b7ca99d0ab92a2f15f101624845a41bcb

  • SHA256

    6f0e1e995f076fae089a915ed7cf6063a12c9ea942979da0fa1e07b94e29169a

  • SHA512

    8d8c0892601deaba2ad3c8abc6cb4e9f84c8fa0c0a400471906571f314729ee02e1018033c093ee4a067c13439b53092fbc78cba59f766731e77c9ffc44fd51c

  • SSDEEP

    3072:tLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:wOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2